Privacy Policy
Effective Date: [ ● ] 2026
South Texas Accelerated Research Therapeutics LP, together with its subsidiaries and controlled affiliates (collectively, “START” “us,” “we,” or “our”) is committed to protecting the privacy of Personal Data (i.e., information reasonably related to a specific individual). This Privacy Notice describes how we process Personal Data collected through our websites, social media accounts, and other online interactions and communications such as email (collectively, our “Digital Properties”); in-person events; and other online and offline interactions.
This Privacy Notice applies to information we collect about individual consumers, such as general website visitors (“Individuals”), as well as information we collect about the personnel of our business partners, including vendors and business customers, in business-to-business interactions (“Business Contacts”). However, this Privacy Notice does not apply to information about our current/former employees, applicants, and other individuals who interact with us for employment-related purposes. This Privacy Notice also does not apply to data (including health data) that we handle on behalf of clinical trial sponsors when conducting a clinical trial, or under the instructions of our Business Contacts (when START acts as a processor).
Whenever you interact with us on behalf of another individual or entity, such as if you refer a friend to us, you must obtain their consent (or have the legal authority without consent) to share their Personal Data with us.
Changes to this Privacy Notice. We may update this Privacy Notice from time to time. Any updated Privacy Notice will be effective when posted. Please check this Privacy Notice periodically for updates. If required by law, we will contact you directly to provide you with an updated Privacy Notice.
1. Sources of Personal Data
We collect Personal Data about you from the following sources:
- Directly from you. We may collect Personal Data you provide to us directly, such as when you contact us through our Digital Properties; interact with us in person; sign up for offers or newsletters; or communicate directly with us. This may include (i) Identifiers (such as your name, email address, postal address, phone number, and contact details as defined below), (ii) communications and user-generated content (such as correspondence, enquiries, feedback, or other content you submit); and professional or employment-related information (where relevant to your interaction with us; including, but not limited to job title, employer, or professional qualifications).
- Data collected automatically and through tracking technologies. We may automatically collect information or inferences about you, including through cookies and other tracking technologies when you interact with our Digital Properties. This may include information about how you use and interact with our Digital Properties, information about your device, and internet usage information. This may include (i) identifiers (such as IP address, device identifiers, cookie identifiers, and advertising IDs), (ii) internet or other electronic network activity information (such as browsing history and interactions with our Digital Properties), and (iii) non-precise geolocation data (derived from IP address); and (iv) inferences about your preferences and usage patterns. For more information about cookies and other tracking technologies, please see our Cookie Policy.
- From third parties. We may collect Personal Data from third parties, such as service and content providers, our affiliated companies and subsidiaries, business partners, social media companies or other parties who interact with us. This may include (i) Identifiers (such as name and contact details), (ii) communications and user-generated content; and Sensitive Personal Data, including information about your health, where this is provided to us in connection with clinical research or related services.
- From publicly available sources. We may collect Personal Data about you from publicly available sources, such as public profiles and websites.
We may combine information that we receive from the various sources described in this Privacy Notice, including third party sources, and use or disclose the combined information for the purposes identified below.
2. Types of Personal Data We Collect
We may collect the following types of Personal Data about you from the sources above. Except as otherwise specified, we may collect this Personal Data about both Individuals and Business Contacts:
- Identifiers, such as your name, email address, physical address, telephone number, business contact information, and device identifiers (e.g., cookie IDs and IP address).
- Communications and user‑generated content, such as the content, timing and method of communications you have with us and information you share with or upload to our Digital Properties, such as reviews and comments.
- Demographic information, such as age (including birthdates) and gender.
- Commercial information, such as information related to products or services purchased, obtained, or considered.
- Internet or other electronic network activity information, such as your browsing history, search history, preference information (including marketing and purchasing preferences), and other information regarding your interactions with and use of the Digital Properties. For more information about how we use cookies and other device data, please see our Cookie Policy.
- Non-precise geolocation data, such as your approximate location as derived from your IP address.
- Audio, electronic, visual, or other sensory information, such as photographs and audio/video recordings.
- Professional or employment-related information (relating to Business Contacts), such as job title; organization; professional licenses, credentials, or affiliations; and other professional information.
- Inferences drawn from any of the information we collect about your preferences or behavior, including to assess the level of interest in our products and services based on frequency of visits and contact and determine your preferred frequency for receiving offers. We use automated processes to generate Inferences from your personal data. START endeavours to always have a human involved in an automated process. We do not make any decisions based solely on automated processing of your personal data which produces legal effects or significantly impacts you.
- Sensitive Personal Data, including information about your health where permitted under applicable data protection laws, in accordance with legal requirements under GDPR and subject to appropriate safeguards.
3. How We Use Personal Data
We may use Personal Data for the following purposes:
- To provide you or your company products and services, making our Digital Properties, products and services available to you; providing customer service; communicating with you (including soliciting feedback or responding to requests, complaints, and inquiries); hosting informational webinars; and providing similar services or otherwise facilitating your relationship with us.
- For our internal business purposes, such as operating our Digital Properties and customizing the content; maintaining internal business records, such as accounting, document management and similar activities; enforcing our policies and rules; management reporting; auditing; and IT security and administration.
- For our internal research and product improvement purposes, such as verifying or maintaining the quality or safety of our products or services; improving our products or services; designing new products and services; evaluating the effectiveness of our advertising or marketing efforts; and debugging and repairing errors with our systems, networks, and equipment.
- For legal, safety or security reasons, such as complying with legal, reporting, and similar requirements; investigating and responding to claims against us, our personnel, our partners, and our customers; for the establishment, exercise or defense of legal claims; protecting our, your, our customers’, and other third parties’ safety, property or rights; detecting, preventing, and responding to security incidents and health and safety issues (including managing spread of communicable diseases); and protecting against malicious, deceptive, fraudulent, or illegal activity.
- In connection with a corporate transaction, such as if we acquire, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy or other forms of corporate change.
- For marketing and targeted advertising, where permitted by applicable law and, where legally required with your consent such as marketing our products or services or those of our affiliates, business partners, or other third parties. For example, we may use Personal Data we collect to personalize advertise to you (including by developing product, brand, or services audiences and identifying you across devices/sites); to analyze interactions with us or our Digital Properties; or to send you newsletters, surveys, questionnaires, promotions, or information. You can unsubscribe from our email marketing via the link in the email, or by contacting us using the information in the Contact Information section below.
We may use anonymized, de-identified, or aggregated information for any purpose permitted by law.
4. How We Disclose Personal Data
We may disclose Personal Data to third parties, including the categories of recipients described below:
- Affiliates and subsidiaries, including parent entities, corporate affiliates, subsidiaries, business units, and other companies that share common ownership.
- Service providers that work on our behalf to provide the products and services you request or support our relationship with you, such as IT providers, internet service providers, web hosting providers, data analytics providers, and companies that provide business support services, financial administration, or event organization.
- Professional consultants, such as accountants, lawyers, financial advisors, and audit firms.
- Vendors necessary to complete transactions you request, such as shipping companies and logistics providers.
- Law enforcement, government agencies, and other recipients for legal, security, or safety purposes, such as when we share information to comply with law or legal requirements, to enforce other agreements or policies; and to protect ours, our customers’, our partners’, or third parties’ safety, property, or rights.
- Other entities in connection with a corporate transaction, such as if we acquire, or sell or transfer all or a portion of our business or assets including through a sale in connection with bankruptcy and other forms of corporate change.
- Business partners that may use Personal Data for their own purposes, such as:
- Advertisers, ad platforms and networks, and social media platforms;
- Third parties whose cookies and tracking tools we use as described in our Cookie Policy; and
- Partners who work with us on promotional opportunities, including co-branded products and services.
Where required by law, we will obtain your consent prior to disclosing your Personal Data to our business partners. Where recipients use your Personal Data for their own purposes independently from us, we are not responsible for their privacy practices or personal data processing policies. You should consult the privacy notices of those third-party services for details on their practices.
- The public, such as when you have an opportunity to make comments regarding us or our products or services that we may share with the public, including testimonials. Any Personal Data in comments, reviews, or other content that you share in public areas of our Digital Properties may be read, collected, or used by other users or the public.
- Entities to which you have consented to the disclosure.
5. Cookies and Other Tracking Technologies
We may collect technical information from and about your device (such as your browser type, operating system, IP address, and domain name) via cookies and other tracking technologies. Please see our Cookie Policy for further information.
6. Data Security and Data Retention
Although we implement appropriate technical and organisational measures designed to protect Personal Data, no security system or method of transmission over the Internet can be guaranteed to be completely secure.
Your Personal Data will only be retained for as long as necessary to fulfill the purposes we have outlined above, unless we are required to do otherwise by applicable law. This includes retaining your Personal Data to provide you with the products or services you have requested and interact with you; maintain our business relationship with you; improve our business over time; ensure the ongoing legality, safety and security of our services and relationships; or otherwise in accordance with our internal retention procedures.
Once you have terminated your relationship with us, we may retain your Personal Data in our systems and records in order to ensure adequate fulfillment of surviving provisions in terminated contracts or for other legitimate business purposes, such as to enable easier future user onboarding, demonstrate our business practices and contractual obligations, or provide you with information about our products and services in case of interest.
We are committed to ensuring the security, integrity and confidentiality of your Personal Data. Taking into account the nature of the Personal Data that we collect and the risks associated with the processing of your Personal Data, we have implemented appropriate technical and organisational measures in accordance with data protection laws to ensure an appropriate level of security and to prevent any accidental or unlawful destruction, loss, alteration, disclosure, intrusion of or unauthorized access to Personal Data.
If you would like to know more about the retention periods applicable to your Personal Data or our data security measures, you can contact us using details provided in the Contact Information below.
7. Children’s Privacy
Our Digital Properties are intended for individuals 18 years of age and older. The Digital Properties are not directed at, marketed to, nor intended for, children under 18 years of age. As a general rule, we do not knowingly collect any information, including Personal Data, from children under 18 years of age. If you believe that we have inadvertently collected Personal Data from a child under the age of 18, please contact us at the address in the Contact Information section below, and we will take prompt steps to delete the information.
8. External Links
Our Digital Properties may contain links to external sites or other online services that we do not control, including those embedded in third party advertisements or sponsor information. We are not responsible for the privacy practices or data collection policies of such third-party services. You should consult the privacy notices of those third-party services for details on their practices.
9. Contact Information
If you have questions regarding this Privacy Notice, please contact us at: information@startresearch.com
Supplemental Information for the EEA, Switzerland and the UK
The following terms supplement the above disclosures with respect to our processing of EU Personal Data, and only apply to the extent that EU data protection laws apply to our processing of your Personal Data. To the extent applicable, in the event of any conflict or inconsistency between the other parts of the Privacy Notice and the terms of this Section, this Section shall govern and prevail with regards to the processing of such EU Personal Data.
Data Controller
The START entity responsible for the processing of your Personal Data as the controller is the entity that has the primary relationship with you. This may be the START group entity whose Digital Property you are viewing or using, that provides services to you, that markets or provides promotional materials to you, or the primary START group entity in the region where you interact with us.
- In Ireland, the controller of your Personal Data is START Research Ireland Opco Limited, with address at One Spencer Dock, North Wall Quay, Dublin 1, Dublin, D01 X9r7, Ireland and privacy contact STARTCenter.dpo@mydata-trust.info.
- In Spain, the controller of your Personal Data is START Research International, S.L.U, with address at Calle Jose Abascal 56, 28003 Madrid, Spain and privacy contact STARTCenter.dpo@mydata-trust.info.
- In Portugal, the controller of your Personal Data is START Research Portugal, Unipessoal Lda with address at Rua Castilho, 39, 8.º E, 1250-068 Lisboa, Portugal and privacy contact STARTCenter.dpo@mydata-trust.info.
You can view the locations of other START group companies here. For further details, please do not hesitate to contact us using the contact details in the Contact Information section above.
Legal Bases for Processing
We process the following categories of personal data for the following processing purposes based on the following legal bases:
Processing purposes
Categories of personal data
Legal bases
To provide you products and services (Section 3.A)
- Identifiers (Section 2.A)
- Records about you (Section 2.B)
- Commercial information (Section 2.D)
- Professional or employment-related information (Section 2.I)
For Business Contacts, performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
For Business Contacts and Individuals, legitimate interests in conducting our business and providing you with our products and services.
For our internal business purposes such as operating our Digital Properties and customizing the content; maintaining internal business records, such as accounting, document management and similar activities; enforcing our policies and rules; management reporting; auditing; and IT security and administration (Section 3.B)
- Identifiers (Section 2.A)
- Commercial information (Section 2.D)
For our Business Contacts, performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
For Business Contacts and Individuals, compliance with a legal or statutory obligation to which we are subject., for example: Companies Act 2014 and Taxes Consolidation Act 1997, and Value-Added Tax Consolidation Act 2010 (Ireland); Código de Comercio, Ley General Tributaria, and Ley del Impuesto sobre el Valor Añadido (Spain); Código Comercial, Lei Geral Tributária, and Código do IVA (Portugal).
For Business Contacts and Individuals, legitimate interests of START in conducting its business.
Business Contacts and Individuals, your consent, when appropriate.
For our internal research and product improvement purposes (Section 3.C)
- Commercial information (Section 2.D)
- Demographic information (Section 2.C)
- Internet or other electronic network activity information (Section 2.F)
- Inferences (Section 2.K)
For Business Contacts and Individuals:
Legitimate interests of START in conducting its business and improving its products and services.
Your consent, when appropriate.
For legal, safety or security reasons (Section 3.D)
- Identifiers (Section 2.A)
- Records about you (Section 2.B)
- Commercial information (Section 2.D)
- Sensitive Personal Data (Section 2.L)
For Business Contacts and Individuals:
Performance of a contract to which you are a party or to take steps at your request prior to entering into a contract.
Compliance with a legal or statutory obligation to which START is subject, for example, health and safety regulations, or anti-money laundering requirements.
Legitimate interests of START in conducting its business, defending its rights for the establishment, exercise or defense of legal claims, detecting, preventing, and responding to security incidents and protecting against malicious or illegal activity, and protecting the safety, property, or rights of customers and third parties.
In connection with a corporate transaction (Section 3.E)
- Commercial information (Section 2.D)
For Business Contacts and Individuals:
Legitimate interests of START in conducting its business.
For marketing and targeted advertising (Section 3.F)
- Identifiers (Section 2.A)
- Demographic information (Section 2.C)
- Commercial information (Section 2.D)
- Internet or other electronic network activity information (Section 2.F)
- Non-precise geolocation data (Section 2.G)
- Inferences (Section 2.K)
For Business Contacts and Individuals:
Legitimate interests of START in marketing and promoting its products.
Your consent, when appropriate.
Sharing your Personal Data
In addition to the third parties listed in section 4 (How we Disclose your Personal Data) above, more than one START group entity may make decisions on how your Personal Data is processed, such as when two START group entities co-sign a contract with you or multiple START group entities organize an event.
In other cases, different START group entities may independently determine how your Personal Data is processed as independent controllers, such as when one START group entity uses Personal Data received from another START group entity to market to you.
Data Retention
When we collect and process your Personal Data within the EU, we will only retain it for as long as it is strictly necessary to achieve the purpose for which we collected it. We must also consider periods for which we need to retain personal data in order to deal with complaints, queries, regulatory requirements, for audit purposes and to protect our legal rights in the event of a claim being made. In general, the following retention criteria apply: (a) data processed for contractual purposes is retained for the duration of the contractual relationship plus the applicable statutory limitation period; (b) data processed on the basis of consent is retained until consent is withdrawn; (c) data processed for compliance with legal obligations is retained for the period required by the applicable law; and (d) data processed on the basis of legitimate interests is retained for so long as the legitimate interest persists, subject to your right of objection.
To determine the appropriate retention period, we consider the amount, nature and sensitivity of the Personal Data, the purposes for which we process your Personal Data and whether those purposes can be achieved through other means. We will also consider if and how we can minimise the Personal Data that we use, and if we can anonymise your Personal Data so that it will no longer be associated with or identify you.
Where required by applicable law (as for example, in Spain), if Personal Data is rectified or erased, or is no longer necessary for the purposes to which it was processed, START may be required to block such Personal Data by adopting appropriate technical and organisational measures to prevent any further processing, including access or visualisation, except where the data must be made available to judges, courts, the Public Prosecutor’s Office or competent public authorities, including data protection authorities, for the purpose of establishing or defending potential liabilities arising from the processing. Blocked Personal Data will only be retained for the applicable statutory limitation period and will be securely deleted once that period has expired. Blocked Personal Data will not be processed for any other purpose.
Your Data Protection Rights
Under the conditions set by applicable data protection laws, you may exercise certain rights regarding your Personal Data.
- Right to Access. You have the right to obtain confirmation from us whether we are processing your Personal Data and related information, as well as the right to obtain a copy of your Personal Data undergoing processing.
- Right to Data Portability. You may receive your Personal Data that you have provided to us in a structured, commonly used and machine-readable format.
- Right to Rectification. You have the right to request the rectification of inaccurate Personal Data and to have incomplete data completed.
- Right to Objection. You have the right to object to the processing of your Personal Data in certain cases.
- Right to Restrict Processing. You may request that we restrict the processing of your Personal Data in certain cases.
- Right to Erasure. You may request that we erase your Personal Data in certain cases.
- Right to Lodge a Complaint. You have the right to lodge a complaint with a supervisory authority in the country where you reside or where the conduct that is the subject of the complaint occurred. You can contact the local supervisory authorities where we operate as follows:
Ireland
Data Protection Commission
6 Pembroke Row
Dublin 2
D02 X963
Ireland
Phone: (01) 765 01 00 or 1800 437 437,
Spain
Agencia Española de Proteccion de Datos (AEPD)
C/ Jorge Juan, 6. 28001 – Madrid
Phone: 900 293 183
Portugal
Comissão Nacional de Proteção de Dados (CNPD)
Av. D. Carlos I, 134, 1º
1200-651 Lisboa
Phone: (+351) 213 928 400
- Right to Refuse or Withdraw Consent. In cases in which we ask for your consent to process your Personal Data, you are free to refuse to give it. If you have given your consent, you may withdraw it at any time without any adverse consequences. The lawfulness of any processing of your Personal Data that occurred prior to the withdrawal of your consent will not be affected.
- Right to Not Be Subject to Automated Decision-making. You have the right to not to be subject to a decision based solely on automated processing and to be given more information about why any such decision was made.
- Right to opt out of Direct Marketing: You may unsubscribe from marketing e-mails by clicking the unsubscribe button at the bottom of each marketing email.
You may exercise these rights by contacting us using the details in the Contact Information section above.
Direct Marketing
Where permitted by direct marketing and e-privacy laws, and with your prior consent where required, we may send you marketing communications about our products and services when you opt-in to receive such marketing communications. We may also send our Business Contacts email marketing to inform you about other services that we offer if we obtain your email address in relation to our services.
Each marketing email we send includes an unsubscribe option, allowing you to opt out of receiving further marketing communications at any time.
We aim to process opt-out requests as quickly as possible. However, it is possible that you may receive some marketing communications before your request has been fully implemented.
International Transfers of Personal Data
Due to the global nature of our operations, some of the recipients mentioned in the How We Disclose Personal Data section of this Privacy Notice may be located in countries outside the EEA, Switzerland or the UK.
Certain third countries have been officially recognized by the European Commission, Switzerland, and the UK Secretary of State as providing an adequate level of protection. The list of countries recognised by the European Commission can be found here: Data protection adequacy for non-EU countries.
Transfers within our corporate group or to third parties located in third countries that do not provide an adequate level of data protection take place using an acceptable data transfer mechanism, such as the EU and/or UK Standard Contractual Clauses (as applicable), or any other valid data transfer mechanism.
Please reach out to us using the contact information in the Contact Information section above if you want to receive further information about how we transfer Personal Data or, where available, a copy of the relevant data transfer mechanism.
Data Protection Officer
We have appointed a Data Protection Officer (“DPO”) to monitor START’s compliance with applicable data protection laws. Our Data Protection Officer can be reached at:STARTCenter.dpo@mydata-trust.info.
